General

  • Target

    ba746cd2f6d1c603879c4847113c0cfd2c1c8ac11b0702f52f33348f8b426e78

  • Size

    219KB

  • Sample

    231010-y7czfahc2z

  • MD5

    3b7b7a32e81b10975e3319b4c41f7b3f

  • SHA1

    34bc3b8d75667b52658af3ccfe60aeeec430da87

  • SHA256

    ba746cd2f6d1c603879c4847113c0cfd2c1c8ac11b0702f52f33348f8b426e78

  • SHA512

    97eca9028ba529930ee68802411eea788cc3ab36e60ebc764657c25f0fc943780bd18fe2965713cdf4102df98797244a3e8b4649239096561fe323b277bb6b5f

  • SSDEEP

    3072:9JftRJRqZQwO8beTy9KhggfP1SSMpE7S5/nFk4g3:9RqmwO8Ay8PbMaInF

Malware Config

Extracted

Family

smokeloader

Botnet

pub1

Extracted

Family

smokeloader

Version

2020

C2

http://host-file-host6.com/

http://host-host-file8.com/

rc4.i32
rc4.i32

Targets

    • Target

      ba746cd2f6d1c603879c4847113c0cfd2c1c8ac11b0702f52f33348f8b426e78

    • Size

      219KB

    • MD5

      3b7b7a32e81b10975e3319b4c41f7b3f

    • SHA1

      34bc3b8d75667b52658af3ccfe60aeeec430da87

    • SHA256

      ba746cd2f6d1c603879c4847113c0cfd2c1c8ac11b0702f52f33348f8b426e78

    • SHA512

      97eca9028ba529930ee68802411eea788cc3ab36e60ebc764657c25f0fc943780bd18fe2965713cdf4102df98797244a3e8b4649239096561fe323b277bb6b5f

    • SSDEEP

      3072:9JftRJRqZQwO8beTy9KhggfP1SSMpE7S5/nFk4g3:9RqmwO8Ay8PbMaInF

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

    • Deletes itself

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks